agentic-workflow-manager 9.4.1 → 9.6.0

package/dist/tests/commands/sensors/bootstrap.test.js

@@ -0,0 +1,175 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+jest.mock('../../../src/commands/sensors/project', () => ({ resolveSensorProject: jest.fn() }));
+jest.mock('../../../src/commands/sensors/detection', () => ({ detectStack: jest.fn() }));
+jest.mock('../../../src/core/registries', () => ({ listRegistries: jest.fn(() => []) }));
+jest.mock('../../../src/commands/sensors/compatibility/pack-source', () => ({ listPackSources: jest.fn() }));
+jest.mock('../../../src/commands/sensors/compatibility/contract', () => ({ ...jest.requireActual('../../../src/commands/sensors/compatibility/contract'), parseSensorPack: jest.fn() }));
+jest.mock('../../../src/commands/sensors/compatibility/live', () => ({ resolveParsedPackCompatibility: jest.fn() }));
+jest.mock('../../../src/commands/sensors/compatibility/source', () => ({ resolveSensorSource: jest.fn() }));
+jest.mock('../../../src/commands/sensors/migrate', () => ({ planV2Migration: jest.fn(), replaceV2ManifestWithV3: jest.fn() }));
+jest.mock('../../../src/commands/sensors/compatibility/materialize', () => ({ materializePortableSensors: jest.fn() }));
+jest.mock('../../../src/commands/sensors/compatibility/safe-file', () => ({ writeProjectFile: jest.fn(), withProjectLease: jest.fn((_root, operation) => operation()) }));
+const bootstrap_1 = require("../../../src/commands/sensors/bootstrap");
+const project_1 = require("../../../src/commands/sensors/project");
+const detection_1 = require("../../../src/commands/sensors/detection");
+const pack_source_1 = require("../../../src/commands/sensors/compatibility/pack-source");
+const contract_1 = require("../../../src/commands/sensors/compatibility/contract");
+const live_1 = require("../../../src/commands/sensors/compatibility/live");
+const source_1 = require("../../../src/commands/sensors/compatibility/source");
+const migrate_1 = require("../../../src/commands/sensors/migrate");
+const migrate_2 = require("../../../src/commands/sensors/migrate");
+const materialize_1 = require("../../../src/commands/sensors/compatibility/materialize");
+const safe_file_1 = require("../../../src/commands/sensors/compatibility/safe-file");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = require("crypto");
+const root = '/project';
+const missing = { state: 'missing', projectRoot: root, manifestPath: `${root}/.awm/sensors.json` };
+const source = { path: '/registry/sensor-packs/js-ts/pack.json', content: '{}', registry: { name: 'baseline', remote: 'local', contentRoot: '/registry' } };
+describe('planSensorBootstrap', () => {
+    beforeEach(() => {
+        jest.clearAllMocks();
+        project_1.resolveSensorProject.mockReturnValue(missing);
+        detection_1.detectStack.mockReturnValue({ pack: 'js-ts', indicators: ['package.json'] });
+    });
+    it('requires an explicit mode for a missing declaration and never calls a writer', async () => {
+        await expect((0, bootstrap_1.planSensorBootstrap)(root)).resolves.toMatchObject({ kind: 'blocked', reason: 'mode-required', changes: [] });
+        expect(pack_source_1.listPackSources).not.toHaveBeenCalled();
+    });
+    it.each(['native-gate', 'opt-out'])('requires a reason for missing %s', async (mode) => {
+        await expect((0, bootstrap_1.planSensorBootstrap)(root, { mode })).resolves.toMatchObject({ kind: 'blocked', reason: 'reason-required', changes: [] });
+    });
+    it('plans a versioned native declaration without writing it', async () => {
+        await expect((0, bootstrap_1.planSensorBootstrap)(root, { mode: 'native-gate', reason: 'remote CI', dryRun: true })).resolves.toEqual({
+            kind: 'create', projectRoot: root, manifestPath: `${root}/.awm/sensors.json`, dryRun: true, configure: true,
+            changes: [{ path: '.awm/sensors.json', action: 'create' }],
+            manifest: { schemaVersion: 3, mode: 'native-gate', reason: 'remote CI' },
+        });
+    });
+    it('returns an idempotent no-op for an existing v3 declaration', async () => {
+        project_1.resolveSensorProject.mockReturnValue({ state: 'configured', projectRoot: root, manifestPath: `${root}/.awm/sensors.json`, packageRoot: root, manifest: { kind: 'v3', pack: { schemaVersion: 3, mode: 'opt-out', reason: 'declared' } } });
+        await expect((0, bootstrap_1.planSensorBootstrap)(root)).resolves.toMatchObject({ kind: 'noop', changes: [] });
+    });
+    it('rejects a mode that conflicts with an existing v3 declaration', async () => {
+        project_1.resolveSensorProject.mockReturnValue({ state: 'configured', projectRoot: root, manifestPath: `${root}/.awm/sensors.json`, packageRoot: root, manifest: { kind: 'v3', pack: { schemaVersion: 3, mode: 'opt-out', reason: 'declared' } } });
+        await expect((0, bootstrap_1.planSensorBootstrap)(root, { mode: 'native-gate', reason: 'other' })).resolves.toMatchObject({ kind: 'blocked', reason: 'mode-conflicts-with-existing-declaration', changes: [] });
+    });
+    it('blocks source-unavailable v2 migration without attempting a candidate', async () => {
+        const v2 = { schemaVersion: 2, pack: 'js-ts', sensors: {} };
+        project_1.resolveSensorProject.mockReturnValue({ state: 'configured', projectRoot: root, manifestPath: `${root}/.awm/sensors.json`, packageRoot: root, manifest: { kind: 'v2', pack: v2 } });
+        source_1.resolveSensorSource.mockReturnValue({ kind: 'source-unavailable', reason: 'no-compatible-registry', remedy: 'install-registry-or-run-awm-update' });
+        await expect((0, bootstrap_1.planSensorBootstrap)(root)).resolves.toMatchObject({ kind: 'blocked', reason: 'no-compatible-registry', changes: [] });
+        expect(migrate_1.planV2Migration).not.toHaveBeenCalled();
+    });
+    it('preserves a legacy v1 manifest and blocks an ambiguous v2 source without writes', async () => {
+        project_1.resolveSensorProject.mockReturnValueOnce({ state: 'configured', projectRoot: root, manifestPath: `${root}/.awm/sensors.json`, packageRoot: root, manifest: { kind: 'legacy', pack: { pack: 'js-ts', sensors: {}, compatibility: {} } } });
+        await expect((0, bootstrap_1.planSensorBootstrap)(root)).resolves.toMatchObject({ kind: 'blocked', reason: 'legacy-v1-preserved', changes: [] });
+        project_1.resolveSensorProject.mockReturnValueOnce({ state: 'configured', projectRoot: root, manifestPath: `${root}/.awm/sensors.json`, packageRoot: root, manifest: { kind: 'v2', pack: { schemaVersion: 2, pack: 'js-ts', sensors: {} } } });
+        source_1.resolveSensorSource.mockReturnValue({ kind: 'source-ambiguous', reason: 'multiple-compatible-registries', remedy: 'configure-one-logical-registry', candidates: ['a', 'b'] });
+        await expect((0, bootstrap_1.planSensorBootstrap)(root)).resolves.toMatchObject({ kind: 'blocked', reason: 'multiple-compatible-registries', changes: [] });
+        expect(migrate_1.planV2Migration).not.toHaveBeenCalled();
+    });
+    it('plans a v2 replacement only after semantic migration proves equivalence', async () => {
+        const v2 = { schemaVersion: 2, pack: 'js-ts', sensors: {} };
+        const resolution = { kind: 'logical', source };
+        const migration = { candidate: { schemaVersion: 3, mode: 'project-sensors', pack: 'js-ts', source: { registry: 'baseline' }, sensors: {} }, equivalent: true, equivalence: {} };
+        const project = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-bootstrap-plan-'));
+        const manifestPath = path_1.default.join(project, 'sensors.json');
+        try {
+            fs_1.default.writeFileSync(manifestPath, JSON.stringify(v2));
+            project_1.resolveSensorProject.mockReturnValue({ state: 'configured', projectRoot: project, manifestPath, packageRoot: project, manifest: { kind: 'v2', pack: v2 } });
+            source_1.resolveSensorSource.mockReturnValue(resolution);
+            migrate_1.planV2Migration.mockReturnValue(migration);
+            await expect((0, bootstrap_1.planSensorBootstrap)(project)).resolves.toMatchObject({ kind: 'migrate', changes: [{ path: '.awm/sensors.json', action: 'replace' }], migration });
+        }
+        finally {
+            fs_1.default.rmSync(project, { recursive: true, force: true });
+        }
+    });
+    it('plans a concrete portable project-sensors declaration from one logical source', async () => {
+        const variant = { id: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.mjs'] };
+        pack_source_1.listPackSources.mockReturnValue([source]);
+        contract_1.parseSensorPack.mockReturnValue({ kind: 'v2', pack: { schemaVersion: 2, name: 'js-ts', sensors: { lint: { fast: true, variants: [variant] } } } });
+        live_1.resolveParsedPackCompatibility.mockResolvedValue({ pack: { schemaVersion: 2, name: 'js-ts', sensors: { lint: { fast: true, variants: [variant] } } }, sensors: { lint: { state: 'certified', reason: 'ok', variantId: 'eslint-9', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] } } });
+        const plan = await (0, bootstrap_1.planSensorBootstrap)(root, { mode: 'project-sensors' });
+        expect(plan).toMatchObject({ kind: 'create', changes: [{ path: '.awm/sensors.json', action: 'create' }, { path: 'eslint.config.mjs', action: 'create' }], manifest: { schemaVersion: 3, mode: 'project-sensors', pack: 'js-ts', source: { registry: 'baseline' } } });
+        expect(JSON.stringify(plan.manifest)).not.toContain('/registry');
+    });
+    it('resolves compatibility from the selected package root', async () => {
+        const variant = { id: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: [] };
+        const pack = { schemaVersion: 2, name: 'js-ts', sensors: { lint: { variants: [variant] } } };
+        pack_source_1.listPackSources.mockReturnValue([source]);
+        contract_1.parseSensorPack.mockReturnValue({ kind: 'v2', pack });
+        live_1.resolveParsedPackCompatibility.mockResolvedValue({ pack, sensors: { lint: { state: 'certified', reason: 'ok', variantId: 'eslint-9', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] } } });
+        await (0, bootstrap_1.planSensorBootstrap)(root, { mode: 'project-sensors', packageRoot: 'packages/web' });
+        expect(live_1.resolveParsedPackCompatibility).toHaveBeenCalledWith(path_1.default.resolve(root, 'packages/web'), pack);
+    });
+    it('blocks project-sensors when compatibility cannot select every declared sensor variant', async () => {
+        const variant = { id: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: [] };
+        pack_source_1.listPackSources.mockReturnValue([source]);
+        contract_1.parseSensorPack.mockReturnValue({ kind: 'v2', pack: { schemaVersion: 2, name: 'js-ts', sensors: { lint: { variants: [variant] } } } });
+        live_1.resolveParsedPackCompatibility.mockResolvedValue({ pack: { schemaVersion: 2, name: 'js-ts', sensors: { lint: { variants: [variant] } } }, sensors: { lint: { variantId: null } } });
+        await expect((0, bootstrap_1.planSensorBootstrap)(root, { mode: 'project-sensors' })).resolves.toMatchObject({ kind: 'blocked', reason: 'sensor-variant-unresolvable', changes: [] });
+    });
+    it('converts a compatibility probe failure into a stable blocked plan', async () => {
+        pack_source_1.listPackSources.mockReturnValue([source]);
+        contract_1.parseSensorPack.mockReturnValue({ kind: 'v2', pack: { schemaVersion: 2, name: 'js-ts', sensors: {} } });
+        live_1.resolveParsedPackCompatibility.mockRejectedValue(new Error('tool probe failed'));
+        await expect((0, bootstrap_1.planSensorBootstrap)(root, { mode: 'project-sensors' })).resolves.toMatchObject({ kind: 'blocked', reason: 'compatibility-unresolvable', changes: [] });
+    });
+    it.each([{ mode: 'invalid' }, { reason: 'line\nbreak' }, { dryRun: 'yes' }, { unknown: true }])('rejects invalid bootstrap options %j before planning', async (input) => {
+        await expect((0, bootstrap_1.planSensorBootstrap)(root, input)).rejects.toThrow(/bootstrap (mode|reason|dryRun|options)/);
+        expect(pack_source_1.listPackSources).not.toHaveBeenCalled();
+    });
+    it('accepts a Windows absolute registry path without treating it as project state', async () => {
+        await expect((0, bootstrap_1.planSensorBootstrap)(root, { mode: 'project-sensors', registryRoot: 'C:\\awm\\registries\\baseline' })).resolves.toMatchObject({
+            kind: 'blocked', reason: 'registry-root-not-configured', changes: [],
+        });
+    });
+    it('rejects applying a dry-run plan before any publisher runs', () => {
+        expect(() => (0, bootstrap_1.applySensorBootstrap)({ kind: 'create', projectRoot: root, manifestPath: `${root}/.awm/sensors.json`, dryRun: true, changes: [], manifest: { schemaVersion: 3, mode: 'native-gate', reason: 'CI' } })).toThrow('dry-run');
+        expect(safe_file_1.writeProjectFile).not.toHaveBeenCalled();
+    });
+    it('publishes native declarations and project sensors through distinct native boundaries', () => {
+        expect((0, bootstrap_1.applySensorBootstrap)({ kind: 'create', projectRoot: root, manifestPath: `${root}/.awm/sensors.json`, dryRun: false, changes: [{ path: '.awm/sensors.json', action: 'create' }], manifest: { schemaVersion: 3, mode: 'native-gate', reason: 'CI' } })).toBe('created');
+        expect(safe_file_1.writeProjectFile).toHaveBeenCalledWith(root, '.awm/sensors.json', expect.any(Buffer), { mode: 'create', createParents: true });
+        expect(safe_file_1.withProjectLease).toHaveBeenCalledWith(root, expect.any(Function));
+        const manifest = { schemaVersion: 3, mode: 'project-sensors', pack: 'js-ts', source: { registry: 'baseline' }, sensors: {} };
+        expect((0, bootstrap_1.applySensorBootstrap)({ kind: 'create', projectRoot: root, manifestPath: `${root}/.awm/sensors.json`, dryRun: false, changes: [{ path: '.awm/sensors.json', action: 'create' }], manifest, source })).toBe('created');
+        expect(materialize_1.materializePortableSensors).toHaveBeenCalledWith(expect.objectContaining({ projectRoot: root, pack: 'js-ts', source, sensors: {} }));
+    });
+    it('delegates a validated migration to the fenced replacement', () => {
+        const candidate = { schemaVersion: 3, mode: 'project-sensors', pack: 'js-ts', source: { registry: 'baseline' }, sensors: {} };
+        const migration = { candidate, equivalent: true, equivalence: {} };
+        const project = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-bootstrap-plan-'));
+        const manifestPath = path_1.default.join(project, 'sensors.json');
+        try {
+            const bytes = Buffer.from('{"schemaVersion":2}\n');
+            fs_1.default.writeFileSync(manifestPath, bytes);
+            const plan = { kind: 'migrate', projectRoot: project, manifestPath, dryRun: false, changes: [{ path: '.awm/sensors.json', action: 'replace' }], migration, source, originalDigest: (0, crypto_1.createHash)('sha256').update(bytes).digest('hex') };
+            expect((0, bootstrap_1.applySensorBootstrap)(plan)).toBe('migrated');
+            expect(migrate_2.replaceV2ManifestWithV3).toHaveBeenCalledWith(plan.manifestPath, candidate, source);
+        }
+        finally {
+            fs_1.default.rmSync(project, { recursive: true, force: true });
+        }
+    });
+    it('rejects a migration plan whose manifest changed after planning', () => {
+        const project = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-bootstrap-stale-'));
+        const manifestPath = path_1.default.join(project, 'sensors.json');
+        try {
+            fs_1.default.writeFileSync(manifestPath, 'replacement');
+            const plan = { kind: 'migrate', projectRoot: project, manifestPath, dryRun: false, changes: [{ path: '.awm/sensors.json', action: 'replace' }], migration: { candidate: {}, equivalent: true, equivalence: {} }, source, originalDigest: (0, crypto_1.createHash)('sha256').update('original').digest('hex') };
+            expect(() => (0, bootstrap_1.applySensorBootstrap)(plan)).toThrow('stale');
+            expect(migrate_2.replaceV2ManifestWithV3).not.toHaveBeenCalled();
+        }
+        finally {
+            fs_1.default.rmSync(project, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/commands/sensors/compatibility/contract.test.js

@@ -8,6 +8,7 @@ const timeout_1 = require("../../../../src/commands/sensors/compatibility/timeou
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const safe_file_1 = require("../../../../src/commands/sensors/compatibility/safe-file");
 const coverage = {
     schemaVersion: 1,
     classes: {
@@ -44,6 +45,8 @@ function validPack() {
     };
 }
 describe('sensor pack v2 contract', () => {
+    beforeEach(() => (0, safe_file_1.setPortableReadForTests)(true));
+    afterEach(() => (0, safe_file_1.setPortableReadForTests)(false));
     it('exports bounded timeout validation and resolution (R3.1, R3.4)', () => {
         expect((0, timeout_1.positiveTimeout)(1, 'sensor timeout')).toBe(1);
         expect((0, timeout_1.resolveTimeout)({ project: 90_000, pack: 30_000, fast: true })).toEqual({ timeoutMs: 90_000, source: 'project' });
@@ -84,6 +87,41 @@ describe('sensor pack v2 contract', () => {
             fs_1.default.rmSync(sensorPacks, { recursive: true, force: true });
         }
     });
+    it('rejects a Semgrep policy that changes between inspection and safe open', () => {
+        const sensorPacks = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-semgrep-policy-'));
+        const packDir = path_1.default.join(sensorPacks, 'python');
+        const policyPath = path_1.default.join(sensorPacks, 'shared', 'semgrep-policy.json');
+        const originalOpen = fs_1.default.openSync.bind(fs_1.default);
+        const open = jest.spyOn(fs_1.default, 'openSync');
+        let replaced = false;
+        try {
+            fs_1.default.mkdirSync(path_1.default.dirname(policyPath), { recursive: true });
+            fs_1.default.mkdirSync(packDir);
+            fs_1.default.writeFileSync(policyPath, JSON.stringify({
+                tool: 'semgrep', toolRange: '>=1.0.0', runtime: 'python', runtimeRange: '>=3.9.0', probe: 'semgrep-validate',
+            }));
+            const pack = validPack();
+            pack.sensors.lint.variants[0] = {
+                id: 'semgrep-python', priority: 10, certifiedRange: '>=1.0.0', policyRef: 'shared/semgrep-policy.json',
+                command: { executable: 'semgrep', resolution: 'path', args: ['--config', '.semgrep.awm.yml', '--json', '.'] },
+                assets: ['.semgrep.awm.yml'], formatter: 'semgrep',
+            };
+            open.mockImplementation(((file, flags, mode) => {
+                if (file === policyPath && !replaced) {
+                    replaced = true;
+                    fs_1.default.writeFileSync(policyPath, JSON.stringify({
+                        tool: 'semgrep', toolRange: '>=2.0.0', runtime: 'python', runtimeRange: '>=3.10.0', probe: 'semgrep-validate',
+                    }));
+                }
+                return originalOpen(file, flags, mode);
+            }));
+            expect(() => (0, contract_1.parseSensorPack)(pack, path_1.default.join(packDir, 'pack.json'))).toThrow(/changed|identity|policyRef/i);
+        }
+        finally {
+            open.mockRestore();
+            fs_1.default.rmSync(sensorPacks, { recursive: true, force: true });
+        }
+    });
     it('fails closed when a policy reference is not the AWM-owned shared Semgrep policy', () => {
         const pack = validPack();
         pack.sensors.lint.variants[0] = {

package/dist/tests/commands/sensors/compatibility/manifest.test.js

@@ -38,6 +38,96 @@ describe('sensor manifest contract', () => {
         expect((0, manifest_1.parseSensorManifest)(manifest, 'sensors.json')).toMatchObject({ kind: 'v2', pack: manifest });
         expect(JSON.parse((0, manifest_1.serializeManifestV2)(manifest))).toEqual(manifest);
     });
+    it('parses the three exact v3 modes without physical registry provenance', () => {
+        const project = {
+            schemaVersion: 3,
+            mode: 'project-sensors',
+            pack: 'js-ts',
+            source: { registry: 'baseline' },
+            packageRoot: 'cli',
+            sensors: validV2Manifest().sensors,
+        };
+        expect((0, manifest_1.parseSensorManifest)(project, 'sensors.json')).toMatchObject({
+            kind: 'v3',
+            pack: { mode: 'project-sensors', source: { registry: 'baseline' }, packageRoot: 'cli' },
+        });
+        expect((0, manifest_1.parseSensorManifest)({ schemaVersion: 3, mode: 'native-gate', reason: 'managed by platform' }, 'sensors.json')).toMatchObject({
+            kind: 'v3', pack: { mode: 'native-gate', reason: 'managed by platform' },
+        });
+        expect((0, manifest_1.parseSensorManifest)({ schemaVersion: 3, mode: 'opt-out', reason: 'not applicable' }, 'sensors.json')).toMatchObject({
+            kind: 'v3', pack: { mode: 'opt-out', reason: 'not applicable' },
+        });
+        expect(() => (0, manifest_1.parseSensorManifest)({ ...project, source: { registry: 'Baseline' } }, 'sensors.json')).toThrow('registry');
+        expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 3, mode: 'native-gate' }, 'sensors.json')).toThrow('reason');
+        expect(() => (0, manifest_1.parseSensorManifest)({ ...project, registryRoot: '/machine/root' }, 'sensors.json')).toThrow('unknown field');
+    });
+    it('serializes v3 deterministically with a newline and round-trips portable semantics', () => {
+        const manifest = {
+            schemaVersion: 3,
+            mode: 'project-sensors',
+            pack: 'js-ts',
+            packSelection: 'explicit',
+            source: { registry: 'baseline' },
+            packageRoot: 'cli',
+            sensors: { lint: { ...validV2Manifest().sensors.lint, enabled: false, fast: true, timeout: 45_000, assets: ['eslint.config.awm.mjs'], policyRef: 'shared/semgrep-policy.json' } },
+            concurrency: 2,
+        };
+        const serialized = (0, manifest_1.serializeManifestV3)(manifest);
+        expect(serialized).toBe((0, manifest_1.serializeManifestV3)(manifest));
+        expect(serialized.endsWith('\n')).toBe(true);
+        expect(serialized).not.toContain('registryRoot');
+        expect(serialized).not.toContain('/home/');
+        expect((0, manifest_1.parseSensorManifest)(JSON.parse(serialized), 'sensors.json')).toEqual({ kind: 'v3', pack: manifest });
+    });
+    it.each(['native-gate', 'opt-out'])('serializes a versioned %s declaration canonically', mode => {
+        const manifest = { schemaVersion: 3, mode, reason: 'declared by project policy' };
+        expect((0, manifest_1.serializeManifestV3)(manifest)).toBe(JSON.stringify(manifest, null, 2) + '\n');
+    });
+    it('refuses to serialize a v3 declaration containing a nested physical path', () => {
+        const manifest = {
+            schemaVersion: 3,
+            mode: 'project-sensors',
+            pack: 'js-ts',
+            source: { registry: 'baseline' },
+            sensors: {
+                lint: {
+                    ...validV2Manifest().sensors.lint,
+                    command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['--config=/home/operator/.config/eslint.config.mjs'] },
+                },
+            },
+        };
+        expect(() => (0, manifest_1.serializeManifestV3)(manifest)).toThrow('physical path');
+    });
+    it('serializes a portable URL in a structured command argument', () => {
+        const manifest = {
+            schemaVersion: 3,
+            mode: 'project-sensors',
+            pack: 'js-ts',
+            source: { registry: 'baseline' },
+            sensors: {
+                lint: {
+                    ...validV2Manifest().sensors.lint,
+                    command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['--rules=https://example.invalid/rules.json'] },
+                },
+            },
+        };
+        expect(JSON.parse((0, manifest_1.serializeManifestV3)(manifest)).sensors.lint.command.args).toEqual(['--rules=https://example.invalid/rules.json']);
+    });
+    it('retains a portable URL in a structured command argument', () => {
+        const manifest = {
+            schemaVersion: 3,
+            mode: 'project-sensors',
+            pack: 'js-ts',
+            source: { registry: 'baseline' },
+            sensors: {
+                lint: {
+                    ...validV2Manifest().sensors.lint,
+                    command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['--rules-url=https://example.test/eslint/rules.json'] },
+                },
+            },
+        };
+        expect(() => (0, manifest_1.serializeManifestV3)(manifest)).not.toThrow();
+    });
     it('accepts and serializes a positive v2 project timeout (R3)', () => {
         const manifest = validV2Manifest();
         manifest.sensors.lint.timeout = 45_000;